🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 89.197.154.115
Firstseen:2024-09-05 05:10:05 UTC
Total malware sites :28
Online malware sites :0 (0%)
Offline Malware sites :28 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2024-09-05 05:10:08 89.197.154.11589-197-154-115.virtual1.co.ukNot listedAS47474 Virtual1- GByes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2025-07-05 18:14:07http://89.197.154.115/https_payload.exeOfflineMetasploit opendir Riordz
2025-07-05 18:14:06http://89.197.154.115/Slack.zipOfflineopendir Riordz
2025-07-05 18:14:05http://89.197.154.115/MSOffice.zipOfflineopendir Riordz
2025-07-05 18:14:05http://89.197.154.115/OBS.zipOfflineopendir Riordz
2024-09-28 07:22:07http://89.197.154.115/Obs_Win.zipOfflinemeterpreter opendir abus3reports
2024-09-28 07:22:07http://89.197.154.115/Excel.zipOfflineHavoc meterpreter opendir abus3reports
2024-09-28 07:22:07http://89.197.154.115/Documents_Win.zipOfflinemeterpreter opendir abus3reports
2024-09-28 07:22:07http://89.197.154.115/Git_Win.zipOfflinemeterpreter opendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/RC-scripts.shOfflineopendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/Git.zipOfflineopendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/Beta.htaOfflineCobalt strike ext opendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/Setup.zipOfflineMetasploit meterpreter opendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/Obs_Lin.zipOfflineopendir abus3reports
2024-09-28 07:22:06http://89.197.154.115/Documents.zipOfflineHavoc opendir abus3reports
2024-09-28 07:22:05http://89.197.154.115/linpeas.shOfflineopendir abus3reports
2024-09-28 07:15:11http://89.197.154.115/Documents.exeOfflinemeterpreter abus3reports
2024-09-28 07:15:11http://89.197.154.115/Session.exeOfflineCobaltStrike ext abus3reports
2024-09-28 07:15:11http://89.197.154.115/Documents.elfOffline abus3reports
2024-09-28 07:15:11http://89.197.154.115/Journal.exeOfflineCobaltStrike ext abus3reports
2024-09-28 07:15:11http://89.197.154.115/Set_up.exeOfflineMetasploit abus3reports
2024-09-05 05:10:10http://89.197.154.115/Prototype.zipOfflineCobaltStrike ext Metasploit lontze7
2024-09-05 05:10:10http://89.197.154.115/Journal.zipOfflineCobaltStrike ext Metasploit lontze7
2024-09-05 05:10:09http://89.197.154.115/Extension.zipOfflineMetasploit lontze7
2024-09-05 05:10:09http://89.197.154.115/Accounts.zipOfflineCobalt strike ext Metasploit lontze7
2024-09-05 05:10:09http://89.197.154.115/UpdaterLOC.dllOfflineCobalt strike ext lontze7
2024-09-05 05:10:09http://89.197.154.115/Accounts.exeOfflineCobalt strike ext CobaltStrike ext lontze7
2024-09-05 05:10:08http://89.197.154.115/Meeting.sfx.exeOfflineMetasploit lontze7
2024-09-05 05:10:08http://89.197.154.115/Meeting.exeOfflineMetasploit lontze7

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2025-07-05 18:14:0745440653bfbdf0ed00e337431c20fa933f056b69c6be4a0c76d1fd29be00cfc1exe Metasploit
2025-07-05 18:14:06f0231b2e58a7a6d1aab680201abe1eda4919d2a0c71c1a94a6873f86027d1fb7zip  
2025-07-05 18:14:054e08040c563d9ad2025345bf770bb4a10058d3c7e84a30d981a5265e71429a6bzip  
2025-07-05 18:14:05454f5874bf6c894c8ca33a76e77fc2332e7001a2287775a371b58eeb055b9c98zip  
2025-03-25 19:44:170456198ac4003bd50d0e03db43cdea2cadcab8062fd8efa6e628b2a639a541c6zip CobaltStrike
2025-03-25 17:58:563254ca400d0512dafb8794f2eecb396272bea8abc03dd974f9794472874eada4zip Metasploit
2025-03-25 17:51:4425bd3cf59e0f1973527fbed210a9100ac80d8002b9535568b43038c738000039zip Metasploit
2025-03-25 17:44:541bf41e452c6f171fd1d1ffbf7706707b4de4dc03b11d1959b5d6c2dbcf57cd76zip Metasploit
2025-03-25 17:14:29da46bff9ea7c8f2bb47d35af5756e936435ecf63e765a553ef1e0c9c665d9d9ezip Metasploit
2025-03-25 17:05:1990fe4b3e548b0ee59a44eaddd7beef09d40b53e1f508a40bcd706e0aa5f8d894zip Havoc
2025-03-25 16:43:241a26e5cd73f7dcaba1bde8f406b531f7145fcefdf540212eb17ccec56e67b27azip Havoc
2024-10-28 15:08:03136018d3aa665931c9b284825ec728eee0eb92561f0ffd3fe736609bfffd50f9zip CobaltStrike
2024-10-28 14:34:469485289c194455d680de90eb1c15325ec45488c6ca87628bb826d92bef581637zip CobaltStrike
2024-10-16 20:28:07b0be091a768c6cf79e047439e4ba2f0451315444cf69a61f66b2f61fdc03ddfczip  
2024-09-28 07:22:07373e0f5ac01f64ddcade8f7442a3ad439211198b721c5470e70e0f71678a0957zip Meterpreter
2024-09-28 07:22:074054933c97e61d742faf934907deb6084bc3767b69c60b5ab949e7f072c391cfzip Meterpreter
2024-09-28 07:22:07cc4c1038d6116b03ea8e8099e5ef7a7b2b2a123239d2d2fd2288208573a799c2zip Meterpreter
2024-09-28 07:22:075785745519cd53c20c83600175c348a02a3182a44c39098016685d3d8f914de7zip Meterpreter
2024-09-28 07:22:06dd4298684a4b2f9f5907825e4276094a661b645a93c4a4e46e2c43157b29c58azip  
2024-09-28 07:22:0643e19bde30e6b5c6e8dfad71d534932cddbd1c28eb3ed7fa2f3042d924dc4581htaCobalt Strike
2024-09-28 07:22:06210a52b070f55db8df0da634b9c7e84dd61d20ef1b69a9709d11f9f31d8da67fzip Meterpreter
2024-09-28 07:22:06a51c319b9efc7b29fecc4cee7c4138a6b3538f9928b2d24ac473f62cad7e2295zip  
2024-09-28 07:22:063d96cdfdcd694fbf42ee2904a460cb2acba53d99baa7eb4fab1203cd4d582b82zip  
2024-09-28 07:15:111bab879de155499cf534749cc0d99bd1f191b18c4efbfb3ed669395337345950elf  
2024-09-28 07:15:11d31ffc39de5e232e602b1bdd599b093778786f5876be835cf23d9bb954a26dcbexe Meterpreter
2024-09-28 07:15:11722359ebd46ace2d25802959791ae3f6af433451d81b915cdb72890cbba357efexe CobaltStrike
2024-09-28 07:15:1112ce354fb01d16524126287cc0b12f14aa3077c6273dc3f479de26b104626658exe CobaltStrike
2024-09-28 07:15:1164ffa88cf0b0129f4ececeb716e5577f65f1572b2cb6a3f4a0f1edc8cf0c3d4fexe Metasploit
2024-09-27 12:51:54ca3fe238aca52f75275b8e67f399bfd53a418c51f729b367896e249961a57ea9zip Metasploit
2024-09-26 12:36:08ad6612a421646e8d90336440ae19311980ed8d2e932013d772262af01444e969zip Metasploit
2024-09-05 12:45:54a0b724fea63d02a4b665dfb5c047da345e949385758e6bdc20b3c42951c549e4exe CobaltStrike
2024-09-05 10:53:3524b5aa4830116e694f3a949b813356199086f3361acbb530e9d80387dcd0bc56zip  
2024-09-05 05:10:08d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960exeMetasploit
2024-09-05 05:10:0879e17050b582c8b73d797c40c80386d78991ebaf04df5a255e39b4fe4d30936fzipMetasploit
2024-09-05 05:10:086779bc4c64850150de694166f4b215ce25bbaca7d60b293fa7bb65e6bdecbc1aexeMetasploit
2024-09-05 05:10:07973d3cdfd9be080ddf08c52581657b2a2be6a4d40cdc34808f854314760caf42zipCobaltStrike
2024-09-05 05:10:07ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5zipMetasploit
2024-09-05 05:10:07a4bf677262344f880b968715a8d8e463ccc4b122ade319ac8b27ba93dc88a9fazipCobalt Strike
2024-09-05 05:10:07080be64f9d322aad325f29c6f90f03f5ea394a24affcdd9b6c2fc834d96e5a6fdllCobalt Strike
2024-09-05 05:10:0770741c5ebc8e2d875337048cedd5d6b17177d051d44c7642d812acfcb2f6f9e6exeCobalt Strike